fix(#1356): tea login resolution fails closed on a declared git identity

get_gitea_login_for_host() returned the FIRST tea login matching the host. With
43 logins on this host, roughly half match one server, so a seat whose own login
was missing silently acted as whichever identity happened to sort first. That
satisfies gate 16 mechanically (an author and a reviewer exist) while violating
it (both are the same actor under two names).

A seat now declares itself via MOSAIC_GIT_IDENTITY or `git config
mosaic.gitIdentity`, and resolution derives the canonical login name from that
identity plus the instance (`<instance>-<seat>`). If that login is absent it
fails closed with a named error and the command to create it. It never borrows.

Same rule on the --repo override path, which had it worse: it fell through to
get_default_tea_login(), i.e. the default-marked login or, failing that, the
first login of ANY host -- an identity chosen by config file order. The four
callers now pass the owner so the instance can be derived. With no identity set
(a human at a terminal) the old fallback is unchanged, which is the same point
at which the token path stops enforcing.

lane-brief.sh mapped owners straight to the SHARED `usc` / `mosaicstack` logins.
The ladder now goes first there, and a seat that cannot resolve its own login
exits rather than falling through to a shared one.

Also adds tools/fleet/seat-logins.sh: projects seat credentials into tea logins
under canonical names, so the name this code requires is one an operator can
mechanically produce rather than hand-maintain.

Test notes:
- The suite had TWO sandbox helpers, run_in_repo and a near-copy run_in_repo2.
  The copy drifted: it never got the identity unset, so the suite kept failing on
  a provisioned seat after the original was already fixed. run_in_repo2 now
  delegates, so the guarantee lives in one place.
- New coverage for both ladder branches (login present -> used; absent -> named
  error and NOTHING on stdout, proving it did not borrow the matching login
  sitting right there), both identity rungs, the --repo path, and explicit
  GITEA_LOGIN outranking the ladder. Each verified by injecting the regression it
  claims to catch and confirming it goes red.
- test-issue-create-body-safety.sh now pins the no-identity case; its subject is
  body quoting, and an ambient seat identity made it fail for an unrelated reason.
- test-issue-close-fail-closed.sh derives its fixture login from the runner's
  identity. This does not make it hermetic and does not claim to: its API-path
  cases need a real credential for the runner's own identity, so it passes only
  where the runner owns one, on this branch and on its base alike. Pre-existing,
  documented in the PR rather than papered over.

packages/mosaic/framework/tools/git/lane-brief.sh

@@ -49,11 +49,27 @@ if [[ -z "$LOGIN" ]]; then
   if [[ -n "${GITEA_LOGIN:-}" ]]; then
     LOGIN="$GITEA_LOGIN"
   else
-    case "${REPO%%/*}" in
-      usc|USC) LOGIN=usc ;;
-      mosaicstack|mosaic) LOGIN=mosaicstack ;;
-      *) LOGIN="$(get_gitea_login_for_repo_override 2>/dev/null || true)" ;;
-    esac
+    # #1356: the owner-derived map below picks a SHARED login (bare `usc` /
+    # `mosaicstack`). On a seat that is borrowing another identity, which is
+    # exactly what gate 16 forbids. So the identity ladder goes first and the
+    # map is only the no-identity fallback (a human at a terminal), which is
+    # where the token path stops enforcing too.
+    if LOGIN="$(get_gitea_login_for_repo_override "$REPO")"; then
+      :
+    elif resolve_git_identity >/dev/null 2>&1; then
+      # A git identity IS set and the ladder still could not resolve a login.
+      # The named reason is already on stderr. Falling through to the map here
+      # would hand this seat a SHARED login (bare `usc` / `mosaicstack`) — the
+      # identity-borrowing #1356 exists to stop. Fail closed instead.
+      exit 2
+    else
+      # No identity: a human at a terminal. Owner-derived map, unchanged. This
+      # is the same point at which the token path stops enforcing.
+      case "${REPO%%/*}" in
+        usc|USC) LOGIN=usc ;;
+        mosaicstack|mosaic) LOGIN=mosaicstack ;;
+      esac
+    fi
   fi
 fi
 [[ -n "$LOGIN" ]] || { echo "FATAL: could not resolve a Gitea login for $REPO (pass -L or set GITEA_LOGIN)" >&2; exit 2; }